How to Scrape Email Addresses from a Website

Implementation notes: the expression is a practical filter, not an email-standard validator. It excludes many unusual but valid address forms and may still match strings that are not usable mailboxes. The script does not verify mailbox existence or permission to contact anyone. The response-size cap limits accidental processing of unexpectedly large pages; choose a limit appropriate to your permitted use.

What the script does and does not do

• It makes one ordinary HTTP GET request, checks for an HTML content type, and applies a timeout.
• It extracts address-shaped text and comma-separated recipients from public mailto links.
• It deduplicates results in memory and normalizes domain casing.
• It does not follow links, execute JavaScript, scrape hidden records, defeat a CAPTCHA, or send email.
• It prints addresses to standard output. For personal data, choose a protected destination and avoid retaining output longer than your purpose requires.

4. Adapt the request carefully

For a permitted internal workflow, you may want to save a provenance record alongside each result. Keep the original page URL, retrieval timestamp, and the narrow reason for collection. Do not add broad crawling simply because the one-page script works.

cURL: inspect the page response

curl --fail --location --max-time 15 \
  --header 'User-Agent: ContactPageResearch/1.0' \
  --output contact.html \
  'https://example.com/contact'

This downloads the HTML response to a local file; it does not extract addresses. Review the response and page rules before processing it. Avoid saving data to shared or public locations.

Node.js: fetch one HTML page

const url = 'https://example.com/contact';
const controller = new AbortController();
const timer = setTimeout(() => controller.abort(), 15_000);

try {
  const response = await fetch(url, {
    headers: { 'User-Agent': 'ContactPageResearch/1.0' },
    signal: controller.signal,
  });
  if (!response.ok) {
    throw new Error(`HTTP ${response.status}`);
  }
  const type = response.headers.get('content-type') || '';
  if (!type.toLowerCase().includes('html')) {
    throw new Error(`Expected HTML, received ${type || 'unknown content type'}`);
  }
  const html = await response.text();
  console.log(`Fetched ${html.length} characters from ${url}`);
  // Parse only for a defined, permitted purpose. For DOM parsing in Node,
  // install and use a parser such as cheerio; do not treat regex as full HTML parsing.
} finally {
  clearTimeout(timer);
}

Node's built-in fetch does not parse HTML. If you add a parser, pin and maintain the dependency, enforce a response-size limit, and extract only the fields required. The Python example shows a complete extraction path for a single page.

5. Handle edge cases without broadening the collection

6. Troubleshooting

7. Performance, reliability, and cost

A single-page request has little setup cost, but network latency and the site's response time dominate. Use a bounded timeout, check status and content type, cap response size, and avoid repeated requests. For a small authorized task, fetch only the needed page and cache your own result only as long as the purpose allows. For larger legitimate migrations, ask the site owner for an export or API; that is usually more reliable than inferring data from rendered pages.

HTML changes can break selectors and extraction assumptions. Log failures without logging unnecessary personal data, retain a timestamp and source for records you keep, and review extracted results before acting on them. Do not treat a syntactically plausible address as deliverable or as consent to receive messages.

Direct fetching has no software API charge in this example, though normal hosting, network, and engineering costs still apply. The material costs may instead be data protection, security, review, and remediation if you collect more than needed or use it in a way people do not reasonably expect. Requirements vary by jurisdiction and context; the sources here do not establish a worldwide legal answer.

8. Or skip the browser setup

If your task is to capture a page image for documentation or review, ScreenshotNeo can return a screenshot with one request. It is a website screenshot API and MCP server for developers, made by Yorker Media. See the ScreenshotNeo site and API documentation.

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/contact -o shot.webp

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com/contact"}, timeout=90)
open("shot.webp", "wb").write(r.content)

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com/contact' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

ScreenshotNeo accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers report the page verdict and billing status. Its MCP server provides take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Screenshot capture is for visual records: it does not extract email addresses or establish permission to collect or use them.

Sign up free for 1,000 screenshots a month, no card required.

9. A practical responsible-collection checklist

• The purpose is specific, documented, and limited.
• Site terms and robots.txt have been reviewed; no access control or explicit objection is being bypassed.
• The relevant jurisdiction and personal-data implications have been assessed.
• Only necessary addresses and provenance fields are retained.
• Results are protected, quality-reviewed, and deleted when no longer needed.
• Any downstream contact has a separately assessed lawful basis and applicable messaging compliance.

10. FAQ

Does a public email address mean I can email it?

No. Publication makes an address observable; it does not itself answer whether a message is lawful, expected, or wanted. Assess the intended use and applicable rules separately.

Can robots.txt give permission to scrape?

No. RFC 9309 explicitly says the protocol is not access authorization. It is one signal to review alongside terms, technical restrictions, privacy obligations, and your purpose.

Is a regex enough to validate an email address?

No. A regex can find common address-shaped strings but cannot establish that an address is valid, active, controlled by a person, or appropriate to use.

Does this script find every address on a site?

No. It processes one returned HTML page and common visible text and mailto patterns. It deliberately does not crawl an entire domain or bypass rendering and access restrictions.

This is practical technical information, not legal advice. The cited guidance is jurisdiction- and context-specific; seek qualified advice for a consequential collection or outreach program.